Can I use this for general Rust projects?

While it utilizes Rust patterns, it is specifically optimized for the Substrate/FRAME framework and focuses on pallet-specific logic, macros, and storage behaviors.

What specific vulnerabilities does this scanner detect?

It scans for seven critical patterns: arithmetic overflow, panic-induced DoS, incorrect weights/fees, verify-first/write-last violations, unsigned transaction flaws, bad randomness, and origin check errors.

How does it handle weight and fee analysis?

It checks if dispatchable functions use proper benchmarking, ensures input parameters are bounded, and identifies fixed weights for variable-cost operations that could lead to DoS.

Is it compatible with newer Substrate versions?

Yes, it includes checks for transactional storage patterns introduced in v0.9.25 and helps identify if older code needs to be upgraded for improved safety.

Does it provide fixes for identified vulnerabilities?

Yes, the skill identifies the specific issue with file references and provides recommended code fixes or mitigation strategies based on Substrate best practices.

Substrate Vulnerability Scanner

Name: Substrate Vulnerability Scanner
Author: monmacllcapp

bymonmacllcapp

0•

Security & Testing

Scans Substrate FRAME pallets for critical vulnerabilities including arithmetic overflows, panic-driven DoS, and incorrect weight calculations.

This skill empowers developers and security auditors to systematically identify and mitigate high-risk vulnerabilities within Substrate runtime modules (pallets). By focusing on seven critical patterns unique to the Polkadot ecosystem—such as arithmetic safety, weight-based DoS, and origin validation—it provides automated analysis, actionable fixes, and specific search patterns to ensure the integrity and stability of blockchain runtimes before deployment.

Key Features

01Detects 7 critical Substrate-specific vulnerability patterns including panic DoS and bad origins.

02Identifies unsafe Rust patterns like unwrap() and expect() within dispatchable functions.

03Provides automated CLI search patterns for rapid, comprehensive codebase auditing.

04Checks for 'Verify First, Write Last' storage violations in pre-v0.9.25 runtimes.

05Analyzes weight calculations and fee logic to prevent network spam and DoS attacks.

060 GitHub stars

Use Cases

01Conducting security audits on custom FRAME pallets before a Polkadot or Kusama parachain launch.

02Reviewing legacy pallet code for storage corruption risks and privilege escalation vulnerabilities.

03Validating arithmetic safety and weight bounds during the active development of Substrate runtimes.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add monmacllcapp/skill-forks substrate-vulnerability-scanner

For use in Claude.ai and ChatGPT

Download Skill